Overview

overview

8

Static

static

6

a16fb323e9...18.apk

android-9-x86

1

a16fb323e9...18.apk

android-11-x64

8

Analysis

  • max time kernel
    179s
  • max time network
    186s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    12/06/2024, 17:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a16fb323e90fb0b2fe8a2d70675dd7fc_JaffaCakes118.apk
  • Size 14.2MB
  • Sample240612-vmcldswerl
  • SHA256 6211210391f4e3fddfc297915b9058dbdddbeb3d6ec33d4b364254ecc18dc0ba
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionimpact

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
    evasion
  • Checks Android system properties for emulator presence. 1 TTPs 5 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 7 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 4 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads device software version 1 TTPs 1 IoCs

    Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).

    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.juzifenqi.app
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Reads device software version
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4672
  • com.juzifenqi.app:pushcore
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4733

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .jg.ac
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.ac
        • Size 40B
        • SHA256 f76863e96bb3f9b5ab4dfcc073e4ee922719bfd10ce0695af6a1f57600174805
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ac
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.ac
        • Size 32B
        • SHA256 56be6457ae044692a7138e883f512b72f2dac22b62b16bca8f5531d80e6cb82b
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ic
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.ic
        • Size 32B
        • SHA256 5d41673550c497d21f3fb62d80e24a4cb3009b41ec325954dcba1a6d77d8d0e8
        • MD5 SHA1 SHA512
        Submit Download

        .jg.rd
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.rd
        • Size 8KB
        • SHA256 a00986a82639199e63ca9cfcf0501bfe9fc93352b899e351c102ba11b3033793
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.ri
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.ri
        • Size 512B
        • SHA256 aad774c37f9cacc289663a0f2276a36fd77b3bc5fcc3e359a30e2b7a483f65e7
        • MD5 SHA1 SHA512
        Submit Download

        .jg.ri
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.ri
        • Size 8KB
        • SHA256 e690fcaf3d36a3d0c5d1dc40f5f3b99ed3ff674a48b7eb6cd236a6a3a62a859a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .jg.store.report_pid
        • Path /data/data/com.juzifenqi.app/files/.jglogs/.jg.store.report_pid
        • Size 32B
        • SHA256 77996d3a1ccd33ad48ab80d348e44ff6b09a959a0f08b4c21b4d8c572961904e
        • MD5 SHA1 SHA512
        Submit Download

        .jiagu.lock
        • Path /data/data/com.juzifenqi.app/files/.jiagu.lock
        • Size 8KB
        • SHA256 34f6b80e864966023499812374edc4163c7ff619763989e5253eef2bb9a2b2e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        classes.dex
        • Path /data/user/0/com.juzifenqi.app/.jiagu/classes.dex
        • Size 5.6MB
        • SHA256 ef5a630c9636ade6f2393fa6468f6ff35884f7d821c80dd0590f4db2ff7aabf4
        • MD5 SHA1 SHA512 SSDEEP
        Download

        classes.dex!classes2.dex
        • Path /data/user/0/com.juzifenqi.app/.jiagu/classes.dex!classes2.dex
        • Size 6.6MB
        • SHA256 f9ebb8d57f094fb70be228b2b4fb06c9e301b022848005df3dee1c99c8e4ae0d
        • MD5 SHA1 SHA512 SSDEEP
        Download

        classes.dex!classes3.dex
        • Path /data/user/0/com.juzifenqi.app/.jiagu/classes.dex!classes3.dex
        • Size 1.4MB
        • SHA256 3c066db1f5d91288ece45f6db2bd31df2dc689d6a0bdbefa7fda9c59012d739c
        • MD5 SHA1 SHA512 SSDEEP
        Download

        libjiagu.so
        • Path /data/user/0/com.juzifenqi.app/.jiagu/libjiagu.so
        • Size 475KB
        • SHA256 0db582d1358bf7a22c7ff4004e6e3bf0856adc4314e7ce58ac5cb7c85209af81
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        td_fm.jar
        • Path /data/user/0/com.juzifenqi.app/cache/td_fm.jar
        • Size 37KB
        • SHA256 9512330b4463942e5e9133676d836fe5afbbac7430d1943c382a6a3968338b37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        td_fm.jar
        • Path /data/user/0/com.juzifenqi.app/cache/td_fm.jar
        • Size 84KB
        • SHA256 a165fd6c0ae33cc8162e164a63b5e5abfafea84a4ef69b3a2845dec716046448
        • MD5 SHA1 SHA512 SSDEEP
        Download

        bugly_db_
        • Path /data/user/0/com.juzifenqi.app/databases/bugly_db_
        • Size 16KB
        • SHA256 f09071fb8727f8601d45a47e6f46dfd2659aae3e27a5771fefc9d530f360fe24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bugly_db_-journal
        • Path /data/user/0/com.juzifenqi.app/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 cb3fea4fde2ffa4cc6fd00da7afd52171b2db1306b5f0909ba5700e344d7ebb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bugly_db_-journal
        • Path /data/user/0/com.juzifenqi.app/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 7bac531af9733add9badc4ce6cd44acac517de1af37229c2d12d4c3d8974dd06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hmdb-journal
        • Path /data/user/0/com.juzifenqi.app/databases/hmdb-journal
        • Size 512B
        • SHA256 9c26af40fc93e25233a7c899bf08a97eb88d4aa3392c00320cdbeabab2281af9
        • MD5 SHA1 SHA512
        Submit Download

        logdb.db
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db
        • Size 36KB
        • SHA256 bfb81bd9548642fc0f8cae27c508e74dc71aacce22c75db004707d07168d7ded
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        logdb.db
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db
        • Size 20KB
        • SHA256 c37824a51b5752abd281ef7d888ed55e2830ba53f3f09530bafed71612caaf0c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        logdb.db-journal
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db-journal
        • Size 512B
        • SHA256 cefcd8380605dd1605530e2f08e2eaa789f51608280ace85f133ec78b83f5ed1
        • MD5 SHA1 SHA512
        Submit Download

        logdb.db-journal
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db-journal
        • Size 8KB
        • SHA256 96b0c6d5f78b19e1937a4acc9d1bc9d46c50576ca3a13551be9fddadbcc8ff18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        logdb.db-journal
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db-journal
        • Size 8KB
        • SHA256 bfc4529ab2315f790a802a9430342cf6bf668ab980930c85f853ea72fad9ed1b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        logdb.db-journal
        • Path /data/user/0/com.juzifenqi.app/databases/logdb.db-journal
        • Size 12KB
        • SHA256 08c70a89d0d75e68e433ac66f44ebe7447b5b86afad2bba1a23ebc8666ad1215
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata
        • Size 24KB
        • SHA256 ae185250bbf23021e48ded90b701377562e8478d4d13166f1d039dedfbaf300b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 512B
        • SHA256 fcb1ed4e4f26736fa857a4846178b3d4a980c4bf91c32613d386a6816d063519
        • MD5 SHA1 SHA512
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 8KB
        • SHA256 895e619b3a0dfbaa9fc9709122867cfdb405ae6a863ab8a4ee72d3f242390bf0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 8KB
        • SHA256 74f71b0f78299ab39ee0d86f47c2fec0959a1562187bdefa678b173075cf02b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 20KB
        • SHA256 72d1e0672f5346f5904aaa5cb09085dc2b71bc594034760bce25fe973fccb80e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 16KB
        • SHA256 f126f21f6137024098fddb641b3dea17f80e5bf83e9e7d4c2e4f8c75ce8cc3aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sensorsdata-journal
        • Path /data/user/0/com.juzifenqi.app/databases/sensorsdata-journal
        • Size 16KB
        • SHA256 9af2c511b026fd9ab897276e34666e4eeb428c972dcf57146906d65a6d73dbe3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        __local_ap_info_cache.json
        • Path /data/user/0/com.juzifenqi.app/files/__local_ap_info_cache.json
        • Size 2B
        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
        • MD5 SHA1 SHA512
        Submit Download

        __local_last_session.json
        • Path /data/user/0/com.juzifenqi.app/files/__local_last_session.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512
        Submit Download

        __local_last_session.json
        • Path /data/user/0/com.juzifenqi.app/files/__local_last_session.json
        • Size 101B
        • SHA256 0711406b454b2a09a69bc08d3b02a1822b9d9e1aa147dbdd2b32cc11fa5a6710
        • MD5 SHA1 SHA512
        Submit Download

        __local_last_session.json
        • Path /data/user/0/com.juzifenqi.app/files/__local_last_session.json
        • Size 177B
        • SHA256 14f0531275aaa1270a7bb3922f2470669d951a8bcb2bd1dad595c853d7ba6cf5
        • MD5 SHA1 SHA512
        Submit Download

        __local_stat_cache.json
        • Path /data/user/0/com.juzifenqi.app/files/__local_stat_cache.json
        • Size 712B
        • SHA256 ade0e667394fc13296f93127c522932b1bc84bf41812724b23f52c72911b1cd8
        • MD5 SHA1 SHA512
        Submit Download

        __send_data_1718211993704
        • Path /data/user/0/com.juzifenqi.app/files/__send_data_1718211993704
        • Size 903B
        • SHA256 47b372b184a7f0565babe157ad07187f692a53656e3106bfbd338a470504c50f
        • MD5 SHA1 SHA512
        Submit Download

        __send_data_1718212001107
        • Path /data/user/0/com.juzifenqi.app/files/__send_data_1718212001107
        • Size 901B
        • SHA256 83b40e08dee1033dc4b3c9d9950f8410a85cce937cc6fc3accd6cab27bc1c53d
        • MD5 SHA1 SHA512
        Submit Download

        5ad6cdbb45b4a14283563bba26a5e0b7.0.tmp
        • Path /data/user/0/com.juzifenqi.app/files/a/b/5ad6cdbb45b4a14283563bba26a5e0b7.0.tmp
        • Size 547B
        • SHA256 28c58876a236e8a6db187fc7eb31e83785acea0bf88df5781e51a1c67912d709
        • MD5 SHA1 SHA512
        Submit Download

        journal
        • Path /data/user/0/com.juzifenqi.app/files/a/b/journal
        • Size 195B
        • SHA256 df62894c08968ff667d8dceab87d74d6275595c04ec78c2e989c082effdd475c
        • MD5 SHA1 SHA512
        Submit Download

        k.store
        • Path /data/user/0/com.juzifenqi.app/files/a/k.store
        • Size 32B
        • SHA256 8728593ce894ea919076e8812397f5438d7c7d70b2809ab815292dcea57b4641
        • MD5 SHA1 SHA512
        Submit Download

        8b9de6f6-1d83-4b10-adb9-19590c2d8dea
        • Path /data/user/0/com.juzifenqi.app/files/jpush_stat_history/active_user/nowrap/8b9de6f6-1d83-4b10-adb9-19590c2d8dea
        • Size 24KB
        • SHA256 03024cb648aea2f615db16ad719bb230e4f7ae7b54c47dac309089821c45fd28
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 24KB
        • SHA256 7fe62847c3afec2723eae933f76f65bae5accddb481ddcf687edb89c8692faef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 24KB
        • SHA256 2b7ef147a145fbfd29b1de99ce59ea0ed6499c64e32629e383b9357304a8a7a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 84KB
        • SHA256 84f04c3fc72057c41d3177962a45b770dea782ac32eeb04e0969b867a09b43d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 36KB
        • SHA256 1b6fb73a45fc3cd5daadc18739c6b427f7112bae1f85158c4bcc496a86e60125
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 36KB
        • SHA256 25a2a2939dec3ab839ce0789d4de4ca9f136e758cf569c1dba54ebb9f5e1471f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 28KB
        • SHA256 ecd7c1957ac879355fb42508bfb11680ef92d63fd0202c1becabfec887c1df4f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd
        • Path /storage/emulated/0/backups/system/.confd
        • Size 32KB
        • SHA256 4f482b08ba290be6f5134cb118594c2e92e7960b3b6e29cb6980ba9186930e6d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 4KB
        • SHA256 42cfbd174123288fdfde36cfba0f5548b553b733842257f293d0851fa37572e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 8KB
        • SHA256 42dc955630221f72b8aa53bccb0926ac9db3aa238cb666ee97395fbeeb0133fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 16KB
        • SHA256 0388748aafa50dec26056b6c5701578b3291c89417b1a70e601c53d9ba4ac295
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 12KB
        • SHA256 b8210d210586038b1a608c8801b6cdfeaf3ad072ae6829666f57723da35cec73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 20KB
        • SHA256 8f341157c090835d6bf14a770bb188eb3e05cfc4ed1bb13ba90d2bbbe8d331dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .confd-journal
        • Path /storage/emulated/0/backups/system/.confd-journal
        • Size 12KB
        • SHA256 fa97805a9493c9bfe66104dff2bdf7f1ac1132783f1ca8d4372952502dbd99ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 119B
        • SHA256 6db38f45ac55309eee5d8b9f023f1f582cab682a5ccad185a89d9e80cdfa5136
        • MD5 SHA1 SHA512
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 328B
        • SHA256 fd104aeed31ce0d4c66f908a74bc1aa6668a5fabfb2874251f1ff9b3bab536cd
        • MD5 SHA1 SHA512
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 16KB
        • SHA256 6c289567dc360768dc2828f1dd1b3ed282463e67b63a9ac1bcee318ebd038507
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 106KB
        • SHA256 4f8326ff5827391b6936e61e04b1fb6ee3ecb04a5397922a5e9d38806a4a53c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 113B
        • SHA256 56b802e60dd3a883f263f0a84e366ebbc1f41abb189ed047b0b77d45a749b275
        • MD5 SHA1 SHA512
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 512B
        • SHA256 7eb5107fc1f0d00de0e2f8b420841208e88c34e1d5ac22722bc66aeb197fd824
        • MD5 SHA1 SHA512
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 8KB
        • SHA256 bd7cb98ef71bab3b11bd2b65be61bbcb02678e3bdc40570946c625a5380732e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .timestamp
        • Path /storage/emulated/0/backups/system/.timestamp
        • Size 138B
        • SHA256 ffa77090282b901058cae7c79ec5f345b22ed4127ff191ca6a24b2088786328c
        • MD5 SHA1 SHA512
        Submit Download